@dooer/dooer-test-env 1.2.2 → 1.3.0

package/lib/command/service.js

@@ -74,12 +74,16 @@ module.exports = {
         },
       })
       .command({
-        command: 'deploy <name> <version>',
-        describe: 'switch a service to a published registry version (upgrade/downgrade)',
+        // NB: the positional is `tag`, NOT `version` — a positional named `version` collides with yargs's
+        // built-in --version flag (enabled in cli.js), which made argv resolve to the boolean `true`.
+        command: 'deploy <name> <tag>',
+        describe: 'switch a service to a published registry version/tag (upgrade/downgrade)',
         handler: (a) => {
+          if (!a.tag || typeof a.tag !== 'string')
+            throw new Error('missing image tag, e.g. `service deploy <name> 1.2.3`')
           const base = imageFor(a.name, rt.SERVICES_DIR)
           if (!base) throw new Error(`unknown service ${a.name} (no manifest image)`)
-          const image = `${base.replace(/:[^:/]+$/, '')}:${a.version}`
+          const image = `${base.replace(/:[^:/]+$/, '')}:${a.tag}`
           // merge into the override compose file
           let ov = { services: {} }
           if (fs.existsSync(rt.OVERRIDE_FILE))

package/lib/compose/generate.js

@@ -18,6 +18,7 @@ const AUTH_PRIVATE_KEY_PEM = Buffer.from(AUTH_PRIVATE_KEY_B64, 'base64').toStrin
 
 // The narrower `booking` profile — the minimum set to drive a booking end to end.
 const BOOKING_PROFILE_SERVICES = [
+  'public-facade', // the browser-facing entrypoint (GraphQL + REST passthrough) — frontends need it
   'service-graphql',
   'service-core-objects',
   'service-accounts',
@@ -101,6 +102,12 @@ const SERVICE_ENV_OVERRIDES = {
   // library's built-in TEST cert (appapi2.test.bankid.com). Present → `up` also sets IS_PRODUCTION=true, so
   // local login uses PRODUCTION BankID exactly like staging (@dooer/config env override beats the
   // per-environment `local:false`). See lib/bankid.js.
+  'public-facade': {
+    // The manifest ships DOOER_HOST_PROTOCOL="" — an EMPTY value that overrides the config default
+    // ("http"), so @dooer/facade builds protocol-less upstream URLs and falls back to port 80
+    // (ECONNREFUSED ::1:80 → 502 on every proxied route). Restore the default explicitly.
+    DOOER_HOST_PROTOCOL: 'http',
+  },
   'service-accounts': {
     // service-accounts is the only token SIGNER — give it the LOCAL dev private key matching the public key
     // forced on every verifier (GLOBAL_OVERRIDES.DOOER_AUTH_PUBLIC_KEY). Non-secret dev material.
@@ -292,7 +299,11 @@ function infraServices() {
 }
 
 // Host ports published so the BROWSER (and dev) can reach things on localhost.
-const GATEWAY_HOST_PORT = 4000 // service-graphql (the public GraphQL facade the frontends' browsers call)
+// public-facade is the browser-facing entrypoint (api.dooer.com / api.s-e032.com): it serves GraphQL AND
+// the REST passthrough (e.g. /v1/companies/:org/documents/:doc/pages/:page image URLs). service-graphql is
+// an internal backend it fronts — NOT the facade — so it gets its own port for direct dev access.
+const FACADE_HOST_PORT = 4000 // public-facade  → DOOER_PUBLIC_FACADE_HOST / DOOER_GRAPHQL_HOST
+const GRAPHQL_HOST_PORT = 4001 // service-graphql (direct access; frontends go through the facade)
 const HQ_HOST_PORT = 8080 // frontend-hq
 
 // host port for a frontend: HQ is pinned to 8080; the rest get 8081+ in sorted order.
@@ -327,7 +338,9 @@ const FRONTEND_URL_ENV = {
 // cross-frontend base URL → its frontend's own host port. Only rewrites keys already present (from the
 // manifest) whose target frontend has a known port. Applied to services AND frontends.
 function rewriteBrowserUrls(env, portMap) {
-  if ('DOOER_PUBLIC_FACADE_HOST' in env) env.DOOER_PUBLIC_FACADE_HOST = `http://localhost:${GATEWAY_HOST_PORT}`
+  // Both point at public-facade (on staging both are https://api.s-e032.com) — not at service-graphql.
+  if ('DOOER_PUBLIC_FACADE_HOST' in env) env.DOOER_PUBLIC_FACADE_HOST = `http://localhost:${FACADE_HOST_PORT}`
+  if ('DOOER_GRAPHQL_HOST' in env) env.DOOER_GRAPHQL_HOST = `http://localhost:${FACADE_HOST_PORT}`
   for (const [key, frontendName] of Object.entries(FRONTEND_URL_ENV)) {
     if (key in env && portMap[frontendName]) env[key] = `http://localhost:${portMap[frontendName]}`
   }
@@ -357,8 +370,9 @@ function buildCompose(services, frontends, { profile } = {}) {
       // (Consul path) which hangs on consul-template.
       command: svc.command || ['./CMD-OPF.sh'],
       environment: rewriteBrowserUrls({ ...buildServiceEnv(svc), ...(SERVICE_ENV_OVERRIDES[svc.name] || {}) }, portMap),
-      // publish the GraphQL gateway on the host so the frontends' browsers can reach it at localhost
-      ...(svc.name === 'service-graphql' ? { ports: [`${GATEWAY_HOST_PORT}:3000`] } : {}),
+      // publish the browser-facing facade (4000) and service-graphql (4001) on the host
+      ...(svc.name === 'public-facade' ? { ports: [`${FACADE_HOST_PORT}:3000`] } : {}),
+      ...(svc.name === 'service-graphql' ? { ports: [`${GRAPHQL_HOST_PORT}:3000`] } : {}),
       // legacy-name DNS aliases (e.g. service-periods → service-closing), so callers resolving the old name
       // reach this container on the compose network.
       ...(SERVICE_ALIASES[svc.name] ? { networks: { default: { aliases: SERVICE_ALIASES[svc.name] } } } : {}),
@@ -382,7 +396,7 @@ function buildCompose(services, frontends, { profile } = {}) {
     // Repoint the facade + every cross-frontend link at the right local ports. Each base URL points at the
     // frontend that SERVES it (e.g. DOOER_PUBLIC_FRONTEND_BASE_URL → frontend-sumify-neue's port), never at
     // this app's own port — that was the bug that sent HQ's "open go.dooer.com" button to localhost:8080.
-    if (!('DOOER_PUBLIC_FACADE_HOST' in env)) env.DOOER_PUBLIC_FACADE_HOST = `http://localhost:${GATEWAY_HOST_PORT}`
+    if (!('DOOER_PUBLIC_FACADE_HOST' in env)) env.DOOER_PUBLIC_FACADE_HOST = `http://localhost:${FACADE_HOST_PORT}`
     rewriteBrowserUrls(env, portMap)
     composeServices[fe.name] = {
       image: fe.image,

package/lib/compose/manifests.js

@@ -19,6 +19,11 @@ const DEFAULT_SERVICES_DIR = path.resolve(
 
 const SERVICE_FILE_RE = /^service-.*\.yaml$/
 const FRONTEND_FILE_RE = /^frontend-.*\.yaml$/
+// Backend services whose manifest filename doesn't match `service-*.yaml` but which are real runnable
+// Deployments we must include. public-facade is the browser-facing REST+GraphQL entrypoint
+// (DOOER_PUBLIC_FACADE_HOST); without it, document page images (/v1/…/pages/…) and other REST passthrough
+// 404. (Jimmy 2026-09-03.)
+const EXTRA_SERVICE_FILES = ['public-facade.yaml']
 
 // Pull the application container out of a Deployment doc. Containers are named
 // `node` across the fleet; fall back to the first container defensively.
@@ -67,7 +72,7 @@ function listServices(servicesDir) {
   const dir = servicesDir || DEFAULT_SERVICES_DIR
   return fs
     .readdirSync(dir)
-    .filter((f) => SERVICE_FILE_RE.test(f))
+    .filter((f) => SERVICE_FILE_RE.test(f) || EXTRA_SERVICE_FILES.includes(f))
     .sort()
     .map((f) => parseManifestFile(path.join(dir, f)))
     .filter(Boolean)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dooer/dooer-test-env",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "description": "Run the whole Dooer backend locally (staging DB minus customers), copy/purge customers between environments, and shred — one CLI.",
   "license": "UNLICENSED",
   "repository": "Dooer/cli-dooer-test-env",